Which version of SwitchYard are you using? Anyway I think SwitchYard would not work with WildFly+OSGi. It's just a plain jar deployment on EAP. If you want to stick to OSGi, then you need to use karaf or Fuse instead.

The excerpt of TRACE logs of the org.jboss.osgi.resolver without Dynamic-ImportPackage would be great!

Using Dynamic-ImportPackage is not wrong per se, however, it is suboptimal. It could be that module exports from picketbox are sufficiently restrictive as to prevent proper OSGi resolution and DIP is the only way to get to them. It could be that there is one missing capability module that does actually export the class you need. Logs will tell. DIP is a legitimate-ish solution if you limit the scope of import, i.e. do NOT use "D-IP: *" but rather "D-IP: org.jboss.security.auth.callback" or as close as possible to your non-failure requirements to limit overhead.